Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-07 Thread Matt Sergeant
Derek Broughton wrote: > From: "Viraj Alankar" <[EMAIL PROTECTED]> > >>Now by being able to see this traffic, we can do some interesting things. > > If > >>anyone has played with dsniff, there are 2 tools in that package that come > > to > >>mind: mailsnarf and tcpkill :). For those that do n

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-04 Thread Olivier Nicole
Jeremy, >STARTTLS tunneled mail does not take kindly to being transparently >redirected, especially if client certificates are being used. Not >sure what percentage of your customers would be using TLS mail, but a >false positive redirect would break things. I'd beleive not many spammer use TL

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-04 Thread Matthew Cline
On Friday 03 May 2002 10:48 am, Viraj Alankar wrote: > Some questions I have is if anyone in a similar situation that I'm in? And > if so, would you think such a system like the above would be useful? I'd > appreciate any suggestions. First check the mail against a private DCC server which SA au

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread LuKreme
On Friday, May 3, 2002, at 06:57 PM, Olivier Nicole wrote: > install SA and silently drop spam traffic. Oooo! that is clever. I like it I like it. -- You are responsible for your rose. ___ Have big pipes? SourceForge.net is looking

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Jeremy Mates
* Olivier Nicole <[EMAIL PROTECTED]> [2002-05-03T18:01-0700]: > What we have been thinking about would be a transparent redirect of > SMTP traffic to a mail gateway. The redirect being installed only for > the known/repported spammers. STARTTLS tunneled mail does not take kindly to being transpar

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Olivier Nicole
> I would suggest notifying an admin person rather than silently dropping. > Silently dropping is really bad should you ever have a false positive. I was talking about 100% identified spammers, only filter them. The war against these few customer has been runnig for ages, blocking their port 25,

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Craig R Hughes
Olivier Nicole wrote: ON> Then install SA and silently drop spam traffic. I would suggest notifying an admin person rather than silently dropping. Silently dropping is really bad should you ever have a false positive. ON> I think thi solution is even better than adding some penalty to all ON> t

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Olivier Nicole
> Some questions I have is if anyone in a similar situation that I'm in? And if > so, would you think such a system like the above would be useful? I'd > appreciate any suggestions. Well I am not ISP, but I once talked to my friend who is working at one and has having the same problem. What we h

Re: [SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Derek Broughton
From: "Viraj Alankar" <[EMAIL PROTECTED]> > > Now by being able to see this traffic, we can do some interesting things. If > anyone has played with dsniff, there are 2 tools in that package that come to > mind: mailsnarf and tcpkill :). For those that do not know, mailsnarf > basically dumps out S

[SAtalk] Brute force spam prevention for NSP's

2002-05-03 Thread Viraj Alankar
Hello, We are a network service provider and over time I have seen the customers that we provide network connectivity to many times generate alot of spam from their network. Many times the business rationale of this is basically it is more profitable to the company to keep these customers. Many